t-mobile[.]grnqws[.]top

This domain, t-mobile.grnqws.top, is an active phishing site designed to harvest T-Mobile customer credentials through a fraudulent login portal. Analysis indicates the site impersonates legitimate T-Mobile authentication pages, likely using social engineering tactics to trick users into entering sensitive account information such as usernames, passwords, and potentially multi-factor authentication codes. The domain employs a deceptive subdomain structure (t-mobile.grnqws.top) to mimic the official T-Mobile brand, increasing the likelihood of successful deception among unsuspecting users. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on May 28, 2026, through NameSilo, LLC, and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Security vendor detections on VirusTotal report 12 out of 95 engines flagging the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. Additionally, the domain appears on one security blocklist, and no SSL certificate is present, further reducing its legitimacy. The page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, a common characteristic of hastily deployed phishing infrastructure. Users who have visited t-mobile.grnqws.top or entered credentials on the site should take immediate remedial action. First, affected individuals must change their T-Mobile account passwords and enable multi-factor authentication if not already active. All connected devices should be reviewed for unauthorized access, and any suspicious activity should be reported to the official support channels. Additionally, users are advised to monitor financial accounts linked to their T-Mobile profile for signs of fraudulent transactions. Clearing browser cache and running a full antivirus scan on the device used to access the site is recommended to mitigate potential secondary infections from malware or tracking scripts.